An Analysis of Real-World Vulnerabilities and Root Causes in the LLM Supply Chain - Moia, Vitor Hugo Galhardo; Meneses, Rodrigo Duarte de; Sanz, Igor Jochem (Anais Estendidos do Simpósio Brasileiro de Cibersegurança (SBSeg); 2025: Anais Estendidos do XXV Simpósio Brasileiro de CibersegurançaDO - 10.5753/sbseg_estendido.2025.11811, 2025)
Generative Artificial Intelligence (GenAI) libraries are increasingly foundational in modern applications, with special attention to Large Language Models (LLMs), yet they exhibit evolving security vulnerabilities that necessitate comprehensive analysis. In this study, we analyze 719 CVEs disclosed for 93 LLM-related libraries (from 2019 to 2024), revealing that more than 37% of libraries have at least one CVE, and that an alarming 62% of vulnerabilities are of high or critical severity, demanding immediate action. Our findings aim to inform actionable recommendations that strengthen security practices and ensure the safe deployment of GenAI technologies.